GHSA-fqf6-gxhh-2xhw: uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

July 7, 2026

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

References

github.com/advisories/GHSA-fqf6-gxhh-2xhw
github.com/uutils/coreutils/pull/9741
github.com/uutils/coreutils/security/advisories/GHSA-fqf6-gxhh-2xhw

Code Behaviors & Features

Detect and mitigate GHSA-fqf6-gxhh-2xhw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →